Legal
Privacy Policy
Effective date: 20 June 2026. This policy explains how Arthabase ("we", "us", or "our") collects and handles your personal data when you use our websites, the app, and the API and MCP services. We apply Indonesia's Personal Data Protection Law (UU No. 27 of 2022).
1. Who we are
Arthabase is operated by PT KITN ANNA ZUCH (PMA), Indonesia. We run the Supply Studio app, Data API and related services at arthabase.com, studio.arthabase.com and data.arthabase.com. For the data described here, Arthabase is the data controller. Contact: hello@arthabase.com.
2. What this policy covers
This policy covers our websites, the app, the API and MCP services. It does not cover third-party websites you open from links inside them (for example an agency site or listing portal). Those sites have their own policies. We apply Indonesia's Personal Data Protection Law (UU No. 27 of 2022).
3. What we collect
- You give us: your email address and anything you include when you email us or use our services; account details such as name and profile fields when you sign in or complete onboarding; billing details such as order references, wallet transactions, invoices and payment status; and support messages. Card details are handled by our payment partners, and we do not store full card numbers.
- Collected automatically: IP address, approximate location, browser and device type, pages viewed, referring page and page interactions. In the app this also includes features you open, map interactions, filters and markets you view, reports you request, API and MCP calls, credits spent, errors, session metadata and timestamps.
- Cookies: see section 6.
4. How we use your data
| Purpose | Basis |
|---|---|
| Running your account, billing and report delivery | Contract |
| Running, securing and improving the sites and app, detecting fraud and abuse, answering enquiries | Legitimate interests |
| Understanding market interest in aggregated or anonymised form (for example which areas or filters are popular) | Legitimate interests |
| Analytics and marketing cookies, and marketing emails | Consent |
| Record keeping and disclosures the law requires | Legal obligation |
We do not sell your personal data, and we do not use it to sell your identity to advertisers.
5. Usage tracking in the app
Inside the app (studio.arthabase.com) we record usage so we can operate, secure and improve the service. This core usage logging has no off switch: if you use the service, we collect the usage data described in section 3.
It is used internally for operations, security, product decisions and anonymised insight into which markets and tools users care about.
For the API and MCP services, we see the calls made.
6. Cookies on our websites
Necessary cookies are always active. Analytics and marketing cookies need your consent. Until you consent, Google tags run in consent-denied mode. You can change your choice at any time through the Cookie settings link in the footer or in your browser. We keep cookie consent records for up to 6 months.
7. When we share data
- Service providers (processors) such as cloud hosting, authentication, analytics, email and automation, and payment partners, under contract and only to serve us
- Authorities or others when the law requires it or to protect rights and safety
8. Third-party links, sellers and AI agents
The app may link to external websites or show contact details for agencies and sellers. If you leave the app or contact a third party (for example an agency from the map), that interaction is between you and them. Arthabase is not responsible for how they handle your data or communications.
If you connect an AI agent or assistant to our API or MCP services, your usage and the data it receives go to that AI provider. We have no partnership with AI providers and do not control how they handle your data. Their terms and privacy policy apply to that use, so please read them before you connect.
9. Retention
We keep personal data for as long as your account is active and as needed for billing, security and legal obligations, then delete or anonymise it. Usage logs may be kept for analytics and abuse investigation, then deleted or anonymised when no longer needed. Marketing emails include an unsubscribe link.
10. International transfers
We are based in Indonesia. Our processors are located in Germany, the United States and Singapore, so your data may leave Indonesia. We make sure transfers meet the requirements of UU PDP, using safeguards where the receiving country does not already offer equivalent protection.
11. Your rights
Under UU PDP and other applicable rules, you may ask us to access, correct or delete your personal data, restrict or object to certain processing, receive your data in a portable form, or withdraw your consent. Email hello@arthabase.com. We may need to verify your identity. If you are not satisfied with our answer, you may also contact the data protection authority that applies to you.
12. Security
We use reasonable technical and organisational measures to protect data. No online service can guarantee perfect security.
13. Children
Our services are not aimed at anyone under 18. We do not knowingly collect data from children.
14. Changes
We may update this policy. The current version is at arthabase.com/privacy/ with an updated effective date. Material changes may be highlighted in the app.
15. Contact
Privacy questions or requests: hello@arthabase.com.